Map car = new HashMap();
car.put("bob","toyota");
car.put("jane","honda");
if (doc['owner'].size() == 0) {
emit ("N/A");
} else {
def keyMap = doc['owner'].value;
if (car.containsKey(keyMap)){
emit (car[keyMap]);
} else {
emit ("N/A");
}
}
when owner = jane, the field will return honda
when owner = bob, the field will return toyota
when onwer = other, the field will return N/A
if owner does not have value, the field will return N/A
I update my maps from time to time, and I have not experienced any issues.
Thank you. Is there a programmatic way to update the variable car in the above example?
I see you could update the entire field via the Kibana API like with something like: (using BrandOwnder field)
POST <kibana host>:<port>/api/index_patterns/index_pattern/<index_pattern_id>/runtime_field/BrandOwner
Is there a good example of using the API to update the a variable within a field? In this example I would like to change the mapping of car to say MAP car ["bob":"ford","jane","lexus"]; but keep the rest of the logic, via the API.
@uncleAlbert I just edit the runtime field in the UI every time I need to update it (essentially I add more puts). I guess you can do the same thing through the API, you POST the updated code version (all lines, not just some of them), as you mentioned
I see. I would like a way automate the process, so the API seems to be my best bet.
From my understanding there is no way to update variables within a runtime field or scripted field via the API. You must overwrite the entire field with the new additions.
from top of my head, and getting into a house that I have not been invited to...
I would maybe version the runtime variable code in github or similar, as a file; then a pipeline should trigger a Kibana API rewrite of the whole runtime field taking the code from the file whenever the file is updated, as last step (I would lint and make some basic checks before).
You could also create another automated event on the other side, to update your script inserting a new line and committing it to the repo, whenever an event triggers the need of a new "put" line.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.